Ban cross origin WebSocket connections to the service protocol

Ban cross origin WebSocket connections to the service protocol.

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip address and host name.

- This has the negative effect of breaking our Dartium work flow, so, I've added the "--disable-service-origin-check" flag to the standalone embedder which disables the security check.

R=asiva@google.com

Committed: https://github.com/dart-lang/sdk/commit/af85432e28cf8080c5ba353793e9dea409c84c9a

[Cutch, 2016-07-07 17:39:53]

Description was changed from

==========
Ban cross origin WebSocket connections to the service protocol

BUG=
==========

to

==========
Ban cross origin WebSocket connections to the service protocol. 

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip
address and host name.

- This has the negative effect making our Dartium work flow stop working, so,
this adds the "--service-dev-mode" flag to the standalone embedder which
disables the security check.
==========

[Cutch, 2016-07-07 17:39:53]

johnmccutchan@google.com changed reviewers:
+ asiva@google.com

[Cutch, 2016-07-07 17:41:11]

Description was changed from

==========
Ban cross origin WebSocket connections to the service protocol. 

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip
address and host name.

- This has the negative effect making our Dartium work flow stop working, so,
this adds the "--service-dev-mode" flag to the standalone embedder which
disables the security check.
==========

to

==========
Ban cross origin WebSocket connections to the service protocol. 

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip
address and host name.

- This has the negative effect of breaking our Dartium work flow, so, I've added
the "--service-dev-mode" flag to the standalone embedder which disables the
security check.
==========

[siva, 2016-07-07 18:06:50]

lgtm

[skybrian, 2016-07-07 18:08:06]

skybrian@google.com changed reviewers:
+ skybrian@google.com

[skybrian, 2016-07-07 18:08:08]

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/main.cc
File runtime/bin/main.cc (right):

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/main.cc#new...
runtime/bin/main.cc:505: { "--service-dev-mode", ProcessServiceDevModeOption },
The meaning of this flag seems a bit subtle. Could we rename it to something
like "--disable-observatory-origin-check" so it's more obvious?

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/vmservice/s...
File runtime/bin/vmservice/server.dart (right):

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/vmservice/s...
runtime/bin/vmservice/server.dart:108: final bool _devMode;
How about "_originCheckDisabled".

[Cutch, 2016-07-07 18:31:56]

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/main.cc
File runtime/bin/main.cc (right):

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/main.cc#new...
runtime/bin/main.cc:505: { "--service-dev-mode", ProcessServiceDevModeOption },
On 2016/07/07 18:08:08, skybrian wrote:
> The meaning of this flag seems a bit subtle. Could we rename it to something
> like "--disable-observatory-origin-check" so it's more obvious?
> 
> 

Done but Observatory != service protocol, so the flag is now
--disable-service-origin-check.

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/vmservice/s...
File runtime/bin/vmservice/server.dart (right):

https://codereview.chromium.org/2125343002/diff/20001/runtime/bin/vmservice/s...
runtime/bin/vmservice/server.dart:108: final bool _devMode;
On 2016/07/07 18:08:08, skybrian wrote:
> How about "_originCheckDisabled".

Done.

[Cutch, 2016-07-07 18:34:01]

Description was changed from

==========
Ban cross origin WebSocket connections to the service protocol. 

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip
address and host name.

- This has the negative effect of breaking our Dartium work flow, so, I've added
the "--service-dev-mode" flag to the standalone embedder which disables the
security check.
==========

to

==========
Ban cross origin WebSocket connections to the service protocol. 

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip
address and host name.

- This has the negative effect of breaking our Dartium work flow, so, I've added
the "--disable-service-origin-check" flag to the standalone embedder which
disables the security check.
==========

[Cutch, 2016-07-07 19:14:58]

Description was changed from

==========
Ban cross origin WebSocket connections to the service protocol. 

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip
address and host name.

- This has the negative effect of breaking our Dartium work flow, so, I've added
the "--disable-service-origin-check" flag to the standalone embedder which
disables the security check.
==========

to

==========
Ban cross origin WebSocket connections to the service protocol.

- Explicitly allow connections from localhost/127.0.0.1 and the server's ip
address and host name.

- This has the negative effect of breaking our Dartium work flow, so, I've added
the "--disable-service-origin-check" flag to the standalone embedder which
disables the security check.

R=asiva@google.com

Committed:
https://github.com/dart-lang/sdk/commit/af85432e28cf8080c5ba353793e9dea409c84c9a
==========

[Cutch, 2016-07-07 19:14:59]

Committed patchset #3 (id:40001) manually as
af85432e28cf8080c5ba353793e9dea409c84c9a (presubmit successful).